How would one go about creating a network of containers more in line with traditional physical networks, with virtual switches, routers etc. ?
(Btw, most current solutions allow some containers to talk to some containers but not others. E.g. using IP subnets)
Since ZeroTier supports hosts connecting to multiple networks, you can setup a pretty sophisticated multi-tiered network architecture, no router needed.
What's the objection to this?
So, questions: Am I correct in thinking this approach would be limited to advisory-only sorts of networking help, and cannot be used as a security boundary? It seems like anything running within a container's network namespace would still need a host interface exposed for its own virtualized packets, and obviously LD_PRELOAD hijinx remain freely ignorable by any program that decides not to go with the libc flow. Maybe it's possible to pick up the host interface, and then jump into the container's limited network namespace and thus be able to give no other options to the other contained processes?
Alternatively, I wonder if this approach could also be plugged in via seccomp filters, as well as LD_PRELOAD hooks? The docs at https://github.com/torvalds/linux/blob/5634347dee31373a8faf0... seem to suggest syscall capture and reroute might be capable of this. This would still be causing a kernel/userspace bounce, which we were trying to avoid, but it would still cut out the unnecessary trips through the host networking stack that we're going to ignore anyway... and more importantly, would actually be strong enough to be relied upon as a security constraint.
Good luck, ZeroTier folks! Looking forward to watching this continue to develop.
And yes there are other mechanisms than LD PRELOAD. It can also be explicitly linked into a binary if you do want to rebuild, or linked into libc, or linked into everything via the dynamic linker configuration files. The latter us how an entire container as opposed to a process can be placed into a virtual net.
For example, say I have a bunch of boxes on some cloud providers like Digital Ocean and Linode. I'd like for them to communicate securely — across data centers and providers — without having to set up SSL for _every_ individual app in the stack (Memcached, PostgreSQL, etc.). At the same time I'd like the boxes to talk to any open port among their peers, and not worry about having to configure iptables separately for every service the box is running. In effect, I want a private network layered on top of what the hosting provider has.
Is this what ZeroTier can do for me? If yes, are a lot of people using it this way? How's the performance? (I notice ZeroTier runs over UDP.) If not, what's the appropriate software?
Has it been shared with any of the folks at the open container initiative? opencontainers.org
I'm sure they'd love to collab.
